Overview
Many UK organisations outsource monitoring to a managed provider and are never quite sure what it would catch. A purple team exercise settles that. We run agreed techniques during UK working hours with your analysts or your provider watching, record which ones raised an alert, and help write and test the missing detections before the session ends.
A purple team exercise is built for improvement rather than surprise. Instead of testing your defenders without their knowledge, our testers and your detection team work in the same room, or the same call, executing attacker techniques openly and watching together whether each one is logged, alerted on or missed. The point is not to win but to measure, and then to fix what the measurement reveals while everyone is still at the table.
We work through a set of techniques drawn from MITRE ATT&CK and chosen to match the threats that matter to you. For each one we run it, check what your tooling captured, and where a detection is missing or weak, your team adjusts the rule or log source on the spot and we run the technique again to confirm it now fires. That immediate loop, execute, observe, tune, re-test, is what makes the exercise so productive compared with a report you action weeks later.
The result is measurable coverage, not just a list of gaps. You finish with a clear picture of which ATT&CK techniques you detect, which you now detect because you tuned them during the exercise, and which need further work, along with the improved rules themselves. It is the fastest way to raise detection maturity and a natural next step after a red team assessment exposes where your visibility falls short.
How we work with UK clients
- Testing windows set in UK time at scoping. India runs 4.5 hours ahead during British Summer Time and 5.5 hours ahead in winter, so our days overlap.
- Fixed proposals in GBP, excluding VAT; the reverse charge usually applies to UK business buyers.
- No traffic leaves our hands until written authorisation is signed by someone entitled to give it, as the Computer Misuse Act 1990 requires.
- Findings labelled for the evidence you file: ISO 27001 Annex A, UK GDPR Article 32, PCI DSS or a supplier questionnaire.
What's included
Our approach
- PlanningWe agree techniques, tooling, participants and success measures with your team.
- ExecutionTesters run each technique openly while defenders watch their tooling.
- MeasurementWe record what was detected, what was missed and why.
- Tuning & re-testDetections are improved on the spot and the technique is re-run to confirm.
- Report & coverageWe deliver before-and-after coverage and the improved detections.
What you receive
- Before-and-after detection coverage by ATT&CK technique
- Improved detection rules created during the exercise
- Record of techniques detected, missed and tuned
- Prioritised list of remaining detection gaps
- Knowledge transfer to your detection team
Standards & frameworks
- MITRE ATT&CK
- PTES
- NIST SP 800-115
- CVSS v4.0
- FCA/PRA operational resilience (SYSC 15A)
Frequently asked questions
What is the difference from a red team?
A red team is covert and measures whether you detect an unannounced attacker. A purple team is collaborative and open, built to improve detection technique by technique while your defenders watch and tune. One grades you; the other coaches you, and they work well in sequence.
What do our defenders need to bring?
Access to the detection tooling they run day to day, the people who manage it, and permission to change rules during the session. The more your team can adjust log sources and detections live, the more coverage you leave the exercise with.
Do we need a mature SOC first?
Not a mature one, but you do need some detection capability to tune, whether in-house or managed. If you have logging and alerting you want to improve, a purple team pays off quickly; if you have almost no visibility yet, we will suggest building that first.
Is your red teaming a CBEST engagement?
No. CBEST is the Bank of England's intelligence-led testing framework and has its own provider requirements. We don't claim to meet them. If a regulator has asked for CBEST, tell us at scoping and we'll say plainly whether we can help with any related work.
Can these exercises support FCA and PRA operational resilience work?
They can feed it. Firms under SYSC 15A identify important business services, set impact tolerances and run scenario testing. A red or purple team exercise aimed at one of those services gives realistic evidence about detection and recovery.